The vulnerability CVE-2026-39690 in Paul Bearne's Author Avatars List/Block plugin arises from missing authorization controls, allowing exploitation of incorrectly configured access control security levels. This affects all versions up to and including 2.1.25. The CVSS score is 5.3 (medium severity) with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or vendor advisory is currently available, and the product is not a cloud service.

The vulnerability allows unauthorized remote attackers to access certain features or data within the Author Avatars List/Block plugin without proper authorization. The impact is limited to confidentiality loss; integrity and availability are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is currently documented, users should monitor vendor communications for updates. Until a patch is available, consider restricting access to the affected plugin functionality through other means if possible.